I added metadata to few rules. All rules need similar fields. (We will make CONTRIBUTING file soon with all requirements for new rules).

Left a few comments - some rules can be merged; some have invalid tests.

All tests need improvements:

• add # ruleid: <name of rule> where the semgrep should find the issue
• add # ok: <name of rule> where semgrep should not find issue

I am a bit worried about number of false positives - is using all these methods always insecure, or can we filter-out some common false positives (e.g., using hardcoded paths)?

If possible, we can enhance messages with guidance on how to fix the issues - propose more secure alternatives or e.g., sanitizing inputs.

Rules like these can be simplified:

patterns:
    - pattern-either: 
      - pattern: |
      tensorflow.load_op_library($PATH)

with

patterns:
  - pattern: |
    tensorflow.load_op_library($PATH)

Once everything is fixed, run semgrep --test ./